@ossy/platform 3.22.0 → 3.23.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ossy/platform",
-  "version": "3.22.0",
+  "version": "3.23.0",
   "description": "Ossy application server runtime",
   "repository": {
     "type": "git",
@@ -49,7 +49,7 @@
     "@aws-sdk/util-format-url": "^3.972.17",
     "@modelcontextprotocol/sdk": "^1.12.1",
     "@ossy/config": "^3.0.9",
-    "@ossy/email": "^3.22.0",
+    "@ossy/email": "^3.23.0",
     "@ossy/event-store": "^3.20.1",
     "@ossy/locale": "^3.4.0",
     "@ossy/manifest": "^3.20.1",
@@ -81,5 +81,5 @@
     "Dockerfile",
     "docker-healthcheck.js"
   ],
-  "gitHead": "29de300fd5e2c36f9d6d00f09eb9f1508997a904"
+  "gitHead": "fba601366c69184bbd82d990429d1a43152645c9"
 }

package/src/ses/inbound-aws-credentials.js

@@ -0,0 +1,34 @@
+/**
+ * The website task also has static AWS keys in its environment, and the SDK
+ * uses those before the task role. Inbound mail is granted to the task role,
+ * so the poller has to ask ECS for that role when it is running in a task.
+ *
+ * @param {NodeJS.ProcessEnv} [env]
+ * @param {typeof fetch} [fetchImpl]
+ */
+export function inboundAwsClientConfig (env = process.env, fetchImpl = globalThis.fetch) {
+  const relative = env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
+  const full = env.AWS_CONTAINER_CREDENTIALS_FULL_URI
+  if (!relative && !full) return {}
+
+  const url = full || `http://169.254.170.2${relative}`
+  return {
+    credentials: async () => {
+      const headers = {}
+      if (env.AWS_CONTAINER_AUTHORIZATION_TOKEN) {
+        headers.Authorization = env.AWS_CONTAINER_AUTHORIZATION_TOKEN
+      }
+      const response = await fetchImpl(url, { headers })
+      if (!response.ok) {
+        throw new Error('Task role credentials could not be read')
+      }
+      const body = await response.json()
+      return {
+        accessKeyId: body.AccessKeyId,
+        secretAccessKey: body.SecretAccessKey,
+        sessionToken: body.Token,
+        expiration: body.Expiration ? new Date(body.Expiration) : undefined,
+      }
+    },
+  }
+}

package/src/ses/inbound-aws-credentials.spec.js

@@ -0,0 +1,36 @@
+import { describe, expect, it } from '@jest/globals'
+import { inboundAwsClientConfig } from './inbound-aws-credentials.js'
+
+describe('inboundAwsClientConfig', () => {
+  it('uses the default chain when the process is not in a task', () => {
+    expect(inboundAwsClientConfig({ AWS_ACCESS_KEY_ID: 'static' })).toEqual({})
+  })
+
+  it('reads the task role and ignores static keys', async () => {
+    const fetchImpl = async (url, { headers }) => {
+      expect(url).toBe('http://169.254.170.2/v2/credentials/task')
+      expect(headers.Authorization).toBe('token')
+      return {
+        ok: true,
+        json: async () => ({
+          AccessKeyId: 'task-key',
+          SecretAccessKey: 'task-secret',
+          Token: 'task-token',
+          Expiration: '2026-10-17T20:00:00.000Z',
+        }),
+      }
+    }
+    const config = inboundAwsClientConfig({
+      AWS_ACCESS_KEY_ID: 'cms-prod',
+      AWS_SECRET_ACCESS_KEY: 'static',
+      AWS_CONTAINER_CREDENTIALS_RELATIVE_URI: '/v2/credentials/task',
+      AWS_CONTAINER_AUTHORIZATION_TOKEN: 'token',
+    }, fetchImpl)
+    await expect(config.credentials()).resolves.toEqual({
+      accessKeyId: 'task-key',
+      secretAccessKey: 'task-secret',
+      sessionToken: 'task-token',
+      expiration: new Date('2026-10-17T20:00:00.000Z'),
+    })
+  })
+})

package/src/ses/poll-inbound-mail.js

@@ -2,11 +2,11 @@ import { DeleteMessageCommand, ReceiveMessageCommand, SQSClient } from '@aws-sdk
 import { GetObjectCommand, S3Client } from '@aws-sdk/client-s3'
 import { fileSesReceipt, sesReceiptFromBody } from '@ossy/email/ses-inbound'
 import { createInProcessSdk } from '../tasks/in-process-sdk.js'
+import { inboundAwsClientConfig } from './inbound-aws-credentials.js'
 
 const ReceiveInbound = { id: '@ossy/email/actions/receive-inbound' }
 
-async function readObject ({ bucket, key }) {
-  const client = new S3Client({})
+async function readObject (client, { bucket, key }) {
   const response = await client.send(new GetObjectCommand({ Bucket: bucket, Key: key }))
   return Buffer.from(await response.Body.transformToByteArray())
 }
@@ -39,12 +39,14 @@ export async function ackInboundMessages (messages, { file, deleteMessage, log }
  * message to one of them. Returns a stop function for shutdown.
  */
 export function startInboundMailPoller ({ queueUrl, bucket, log } = {}) {
-  const sqs = new SQSClient({})
+  const clientConfig = inboundAwsClientConfig()
+  const sqs = new SQSClient(clientConfig)
+  const objects = new S3Client(clientConfig)
   const abort = new AbortController()
 
   const file = (body) => fileSesReceipt(sesReceiptFromBody(body), {
     bucket,
-    getObject: readObject,
+    getObject: (location) => readObject(objects, location),
     invoke: ({ mime, workspaceId }) => createInProcessSdk()
       .forWorkspace(workspaceId)
       .invoke(ReceiveInbound, { mime, workspaceId }),